CVE-2026-93018: Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p
CVE-2026-93018: Imager for Perl versions before 1.036 disclose uninitialized heap memory when reading paletted images with pixel indexes past the colour map.
Stig Palmquist disclosed CVE-2026-93018, an information disclosure flaw in the Imager library for Perl. Versions before 1.036 return uninitialized heap memory through i_gpix_p and i_glin_p when a paletted image contains pixel indexes beyond its colour map, potentially leaking sensitive process memory via decoded image data. The fix is included in Imager 1.036; no exploitation has been reported.
- Uninitialized heap memory exposed via i_gpix_p and i_glin_p
- Triggered by paletted images with out-of-range pixel indexes
- Fixed in Imager 1.036 for Perl
- CVEs
- CVE-2026-93018
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93018 | Heap Memory Disclosure in Imager Perl Module (< 1.036) via Paletted Image Parsing | 5.5 | — |
From the original article
Posted by Stig Palmquist on Sep 18 ======================================================================== https://metacpan. org/dist/Imager https://github. com/tonycoz/imager Imager versions before 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.